Allow recovery to read files with oemfs label

The recovery and update_binary need to access the /oem partition for
devices like sprout.

Bug: 19764039
Change-Id: Ie6cbcae899ad664c6a1809c0d5478031091b6eda

recovery.te

@@ -76,6 +76,9 @@ recovery_only(`
   allow recovery cache_file:dir create_dir_perms;
   allow recovery cache_file:file create_file_perms;
 
+  # Read files on /oem.
+  r_dir_file(recovery, oemfs);
+
   # Reboot the device
   set_prop(recovery, powerctl_prop)